self-hosted_cal.diy vulnerabilities

CVEs whose affected-version data names the self-hosted_cal.diy package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-57858High· 8.9PoC

2mo ago

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analyt…

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analyt…

▾ MidnightCal.com · Cal.com Self-Hosted (Cal.diy)EPSS 0.37%via NVD